What it does
A planned network gateway: filtering, encryption and visibility on one Pi, behind the same four-endpoint contract. It stopped at the plan because the research surfaced a conflict with a rule the platform had already committed to.
- Filters DNS
- Blocklists applied at the resolver, with per-client visibility into what was asked for and what was refused.
- Would terminate a tunnel
- The piece that is in conflict: standing up WireGuard means forwarding a UDP port, and the platform forbids port forwarding precisely because Tailscale already solved remote access.
- Never severs its own management path
- A firewall write arms a dead-man rollback before it applies, and refuses outright any rule that would cut the path used to reach the machine. This is specified before any code because it is not a thing to add later.
How it works
Specified, not built
A Pi that filters, encrypts and watches the network, with the same four-endpoint contract on the front of it.
Why it stopped at the plan
The research turned up a conflict the platform had already decided against itself. Every other module reaches the outside world over Tailscale, and the platform forbids port forwarding outright. Tailscale is WireGuard. Standing up a second WireGuard endpoint means opening a UDP port — the exact thing the rule exists to prevent.
So the open question is not “how do we build this” but “what is this module for, given the platform already solved remote access”. That is a better question to be stuck on than a technical one, and it is why there is no code.
Testing
none yet
Not built, so there is nothing to report honestly as a pass. What exists is the set of tests the plan commits to writing first — and for a module that edits a firewall, those are the design, not a follow-up task.
What the tests defend
- The first test is the one that has to exist before any code that writes a rule: applying a change must arm a dead-man rollback that reverts it unless it is confirmed. The failure it defends against is a rule that locks the machine's own management path, which cannot be fixed remotely by definition — you have to walk to it with a keyboard.
- A second test refuses any rule that would sever the Tailscale path, checked before the rule is applied rather than after. A rollback recovers from a mistake; this is the class of mistake worth not making, because the rollback timer is the only thing standing between it and a locked-out machine.
- The suite has to run on a laptop, with no root and no live firewall, which means the nftables layer sits behind the same Protocol-with-a-mock-twin pattern the other three modules use. A test that needs root is a test nobody runs.
Built with
- Operates
- WireGuardnftablesPi-hole
- Service
- PythonFastAPI